1

It is not uncommon for large routers to have unpredictable, random port allocation (which cripples UDP hole punching by making port prediction impossible) and for firewalls (not the software firewall built into your device, but something more upstream) to block all outgoing UDP and TCP traffic except for TCP on ports 80 and 443. This doesn't stop Skype from working - I have used Skype behind such routers and Skype will just relay all the data over a server listening on port 80 or 443. Computer viruses could do the same thing - just relay traffic over a server and make it look like an HTTP get request or something like that.

So how does random port allocation (symmetric NAT) improve security? What about blocking all outgoing UDP? Blocking all outgoing TCP other than port 80 and 443? It seems to me that these measures mostly just make my Skype slow and inconvenience people.

* Update *

I'm asking why is it that large (symmetric, carrier grade, large scale, etc.) routers often choose random (between 1024 and 65535) ports rather than predictable (3000, 3001, 3002, etc.) ports that are easy to guess and why local businesses drop all outgoing UDP packets and send in RST packets to kill any TCP connections that aren't directed at port 80 or port 443.

  • your question exactly is way statefull FW and the next generation and next next generation FW start to cames up. – Gadeliow Sep 30 '15 at 14:27
  • The security SE has answers for your second question, I would check that out. security.stackexchange.com/questions/76755/… – Chris Balmer Sep 30 '15 at 18:48
  • Allright. Well I'm going to let applications like Skype just tunnel or forward their data over whatever ports may be open (TCP 80, TCP 433, UDP 53, etc) and every other application can do the same. – Sacha T Red Sep 30 '15 at 21:43
  • Because ultimately, it doesn't seem like Winn Dixie or Starbucks is using their port limiting to facilitate logging and backing up all packets that go through their network. I mean they might, but it seems like firewall is mostly just designed to annoy the application developers. Haha – Sacha T Red Sep 30 '15 at 21:48
6

You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies.

UDP hole punching is used on NAT, which may or may not be configured on a firewall or plain old router. NAT is designed for IPv4 address conservation, not security.

A firewall will typically block traffic originated from an outside source. If the conversation is started from inside the firewall, the destination host outside the firewall is allowed to continue the conversation through the firewall.

Many home router/NAT/firewall combinations tend to confuse people. You can usually turn off NAT if you have enough public IP addresses, but leave the firewall enabled, or vice versa. Many even allow the router and NAT to be disabled while preserving the firewall.

You need to separate these disparate technologies and rethink your question.

  • "NAT is designed for IPv4 address conservation, not security." I have reason to think that this is not the case for many of the larger routers. Many of these routers often allocate ports in an unpredictable way which is not conducive to UDP hole punching. They could easily just increment the port number by 1 for every outbound connection, wrap around to 1025 when it hits 65535, and programs like Skype would just guess the next higher port number and hole punching would succeed. In addition, I have seen routers that increment on same ip, but random for connections made to different ips. – Sacha T Red Sep 30 '15 at 6:07
  • A great example would be my local Winn Dixie WiFi. Totally random port numbers for each outbound connection. No logical reason to do so other than making hole punching (guessing the port number) difficult. – Sacha T Red Sep 30 '15 at 6:09
  • "A firewall will typically block traffic originated from an outside source." Not the case for many local business WiFi's. They just send in RST packets in reply to any outgoing SYN packet that isn't to port 80 or port 443. – Sacha T Red Sep 30 '15 at 6:11
  • I honestly think that you don't understand the question, haha. I'm saying why is it that large (symmetric, carrier grade, large scale, etc.) routers often choose random (between 1024 and 65535) ports rather than predictable (3000, 3001, 3002, etc.) ports that are easy to guess and why local businesses drop all outgoing UDP packets and send in RST packets to kill any TCP connections that aren't directed at port 80 or port 443. – Sacha T Red Sep 30 '15 at 6:14
  • Why do they do all this crap? Is it to improve security? If so, how? – Sacha T Red Sep 30 '15 at 6:18
5

I honestly think that you don't understand the question

I don't understand your question either, and it's probably because I believe you're operating under incorrect assumptions.

Let me be clear - your provider doesn't care about you trying to NAT traverse to make your Skype calls better. They care about making money, minimizing outages, and lowering their transit costs if they're not tier 1. That's basically it. The "large scale" or "carrier grade" routers you're referring to have very little to nothing to do with NAT or "picking ports". Even routers that are directly upstream of the router in your home (or the the Winn Dixie), don't care about NAT. The whole point of NAT is that your end device doesn't know it's being NATed, and the carrier's edge router doesn't care - they see a destination IP address and a source IP address which they have allocated to you, and they want to get those packets off of their network as quickly as possible. As Ron has said, NAT was designed for address preservation/conservation and "mobility" in mind, so that customers at the edge of the carrier's network could make the most use out of their allocated address space. Most routers at the "large" scales you're referring to are not deployed in production networks with design considerations that involve doing any kind of NAT, they're implemented for their FIB/RIB capacity, port density, type of interfaces available, TCAM size, backplane speed, etc. etc. The finger pointing regarding the port selection need not be at the carrier and their equipment, it needs to be squarely at the client initiating the connection and its upstream first-hop L3 device that's performing the NAT.

So if your question is, "why don't the clients pick easy to guess ports?" (or say sequential ports), the answer is many implementations had done just this when choosing an ephemeral port: "take the last currently in-use port, add one, get new ephemeral port"

However, you need to understand that choosing an ephemeral port isn't only something that the client has to care about - a "collision" would occur in the following scenario (somewhat simplified and contrived):

CLIENT_IP:EPH_PORT     <----FIN----       WEBSERVER:80
CLIENT_IP:EPH_PORT     --FIN/ACK-->       WEBSERVER:80
CLIENT_IP:EPH_PORT     <----ACK----       WEBSERVER:80

So now the client's state of the connection is gone, and the webserver's TCP session is in FIN_WAIT. If the client used the "next available + 1" ephemeral port criteria, and used the same ephemeral port that it used previously to connect to the same webserver while the previous session was still in FIN_WAIT on the webserver, there would be a problem.

Regarding the blocking of everything outbound but 80 and 443, that's again up to the person that manages the equipment at the edge, not the carrier. Carriers simply just don't do this. If I'm feeling like an extremely cautious or paranoid admin and I was managing the network infrastructure/WiFi in a highly public place, I would likely do the same thing.

NAT is not a means of security. The ephemeral ports chosen for NAT can be and sometimes are obfuscated for security measures however, as you've noticed; an attacker can in fact do nefarious things if they have a means of easily guessing the next ephemeral port used in a transport-layer flow.

  • I'm confused about three points. First, your use of the word "ephemeral port". Typically, when I use the word "ephemeral port", I am referring to a port on my local computer/mobile_device that is randomly assigned by my operating system to some number between 32768 and 61000. I don't know what you mean by "ephemeral port" in this answer. Do you mean the public port on the outside of the NAT? – Sacha T Red Sep 30 '15 at 16:01
  • So let's say the client bound their TCP socket to an ephemeral port 40,000 on their local machine. The router translated their port of origin from 40,000 to 20,000. Then the server terminates that TCP connection. Port 40,000 on the client's local machine is unavailiable for binding for a variable time, "between 55 and 59 seconds, when the kernel refuses to allow a non-root user to reopen a socket." So then the user makes another connection, this time from ephemeral port 30,000. Why doesn't router translate that to public port (40,000 + 1)? – Sacha T Red Sep 30 '15 at 16:10
  • "The ephemeral ports chosen for NAT can be and sometimes are obfuscated for security measures". So do they make the public port numbers un-guessable for security (executable A cannot communicate outside the local network) or do they do it for FIB/RIB capacity, port density, etc? – Sacha T Red Sep 30 '15 at 16:13
  • 1
    It doesn't completely stop it - attackers that are persistent enough will find ways to do nefarious things, but it simply limits attack vectors. Are you actually looking for an answer to a question or did you really just post this to troll / argue? – John Jensen Sep 30 '15 at 18:49
  • 1
    @MichaelLafayette, what ports are open on a firewall for outsiders to get to servers inside the firewall has absolutely nothing to do with NAT. You need to decide if you are ranting about NAT and the lack of IPv4 addresses causing the carriers to use CGN, or are you ranting about firewalls. One is not the other. – Ron Maupin Sep 30 '15 at 21:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.